Revert "supplicant: enable WPA3 for WPA-PSK connections"

Enabling WPA3 automatically for key_mgmt=wpa-psk is a change in
behaviour which might have unintended side effects and thus not suitable
for a stable upload.

4 files changed, 218 insertions, 0 deletions

diff --git a/debian/patches/Revert-supplicant-detect-the-SAE-interface-capability.patch b/debian/patches/Revert-supplicant-detect-the-SAE-interface-capability.patch
new file mode 100644
index 00000000..1cd6e5d6
--- /dev/null
+++ b/debian/patches/Revert-supplicant-detect-the-SAE-interface-capability.patch
@@ -0,0 +1,86 @@
+From: Michael Biebl <biebl@debian.org>
+Date: Mon, 21 Mar 2022 15:39:19 +0100
+Subject: Revert "supplicant: detect the SAE interface capability"
+
+This reverts commit 4e018bef68046697dec9f8f698c4a3ff9a20f79a.
+---
+ src/core/supplicant/nm-supplicant-interface.c | 17 ++---------------
+ src/core/supplicant/nm-supplicant-types.h     |  2 --
+ 2 files changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/src/core/supplicant/nm-supplicant-interface.c b/src/core/supplicant/nm-supplicant-interface.c
+index 82ede56..f79f196 100644
+--- a/src/core/supplicant/nm-supplicant-interface.c
++++ b/src/core/supplicant/nm-supplicant-interface.c
+@@ -1171,24 +1171,19 @@ parse_capabilities(NMSupplicantInterface *self, GVariant *capabilities)
+     const gboolean                old_prop_scan_ssid   = priv->prop_scan_ssid;
+     const guint32                 old_max_scan_ssids   = priv->max_scan_ssids;
+     gboolean                      have_ft              = FALSE;
+-    gboolean                      have_sae             = FALSE;
+     gint32                        max_scan_ssids;
+     const char **                 array;
+ 
+     nm_assert(capabilities && g_variant_is_of_type(capabilities, G_VARIANT_TYPE_VARDICT));
+ 
+     if (g_variant_lookup(capabilities, "KeyMgmt", "^a&s", &array)) {
+-        have_ft  = g_strv_contains(array, "wpa-ft-psk");
+-        have_sae = g_strv_contains(array, "sae");
++        have_ft = g_strv_contains(array, "wpa-ft-psk");
+         g_free(array);
+     }
+ 
+     priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities,
+                                                      NM_SUPPL_CAP_TYPE_FT,
+                                                      have_ft ? NM_TERNARY_TRUE : NM_TERNARY_FALSE);
+-    priv->iface_capabilities = NM_SUPPL_CAP_MASK_SET(priv->iface_capabilities,
+-                                                     NM_SUPPL_CAP_TYPE_SAE,
+-                                                     have_sae ? NM_TERNARY_TRUE : NM_TERNARY_FALSE);
+ 
+     if (g_variant_lookup(capabilities, "Modes", "^a&s", &array)) {
+         /* Setting p2p_capable might toggle _prop_p2p_available_get(). However,
+@@ -1283,10 +1278,6 @@ _get_capability(NMSupplicantInterfacePrivate *priv, NMSupplCapType type)
+                 value = iface_value;
+         }
+         break;
+-    case NM_SUPPL_CAP_TYPE_SAE:
+-        nm_assert(NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, type) == NM_TERNARY_DEFAULT);
+-        value = NM_SUPPL_CAP_MASK_GET(priv->iface_capabilities, type);
+-        break;
+     default:
+         nm_assert(NM_SUPPL_CAP_MASK_GET(priv->iface_capabilities, type) == NM_TERNARY_DEFAULT);
+         value = NM_SUPPL_CAP_MASK_GET(priv->global_capabilities, type);
+@@ -1314,13 +1305,9 @@ nm_supplicant_interface_get_capabilities(NMSupplicantInterface *self)
+     caps = NM_SUPPL_CAP_MASK_SET(caps,
+                                  NM_SUPPL_CAP_TYPE_FT,
+                                  _get_capability(priv, NM_SUPPL_CAP_TYPE_FT));
+-    caps = NM_SUPPL_CAP_MASK_SET(caps,
+-                                 NM_SUPPL_CAP_TYPE_SAE,
+-                                 _get_capability(priv, NM_SUPPL_CAP_TYPE_SAE));
+ 
+     nm_assert(!NM_FLAGS_ANY(priv->iface_capabilities,
+-                            ~(NM_SUPPL_CAP_MASK_T_AP_MASK | NM_SUPPL_CAP_MASK_T_FT_MASK
+-                              | NM_SUPPL_CAP_MASK_T_SAE_MASK)));
++                            ~(NM_SUPPL_CAP_MASK_T_AP_MASK | NM_SUPPL_CAP_MASK_T_FT_MASK)));
+ 
+ #if NM_MORE_ASSERTS > 10
+     {
+diff --git a/src/core/supplicant/nm-supplicant-types.h b/src/core/supplicant/nm-supplicant-types.h
+index 8836bba..adcf02d 100644
+--- a/src/core/supplicant/nm-supplicant-types.h
++++ b/src/core/supplicant/nm-supplicant-types.h
+@@ -41,7 +41,6 @@ typedef enum {
+     NM_SUPPL_CAP_TYPE_FILS,
+     NM_SUPPL_CAP_TYPE_P2P,
+     NM_SUPPL_CAP_TYPE_FT,
+-    NM_SUPPL_CAP_TYPE_SAE,
+     NM_SUPPL_CAP_TYPE_SHA384,
+     NM_SUPPL_CAP_TYPE_MESH,
+     NM_SUPPL_CAP_TYPE_FAST,
+@@ -72,7 +71,6 @@ typedef enum {
+     _NM_SUPPL_CAP_MASK_DEFINE(MESH),
+     _NM_SUPPL_CAP_MASK_DEFINE(WFD),
+     _NM_SUPPL_CAP_MASK_DEFINE(FT),
+-    _NM_SUPPL_CAP_MASK_DEFINE(SAE),
+     _NM_SUPPL_CAP_MASK_DEFINE(SHA384),
+ #undef _NM_SUPPL_CAP_MASK_DEFINE
+ } NMSupplCapMask;
diff --git a/debian/patches/Revert-supplicant-enable-WPA3-for-WPA-PSK-connections.patch b/debian/patches/Revert-supplicant-enable-WPA3-for-WPA-PSK-connections.patch
new file mode 100644
index 00000000..3e85edd8
--- /dev/null
+++ b/debian/patches/Revert-supplicant-enable-WPA3-for-WPA-PSK-connections.patch
@@ -0,0 +1,25 @@
+From: Michael Biebl <biebl@debian.org>
+Date: Mon, 21 Mar 2022 15:39:16 +0100
+Subject: Revert "supplicant: enable WPA3 for WPA-PSK connections"
+
+This reverts commit b5133424271a498fe5e9d605a9538059a2753376.
+---
+ src/core/supplicant/nm-supplicant-config.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c
+index bc2a692..eab494b 100644
+--- a/src/core/supplicant/nm-supplicant-config.c
++++ b/src/core/supplicant/nm-supplicant-config.c
+@@ -841,11 +841,6 @@ nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig *
+             g_string_append(key_mgmt_conf, " wpa-psk-sha256");
+         if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+             g_string_append(key_mgmt_conf, " ft-psk");
+-        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SAE)) {
+-            g_string_append(key_mgmt_conf, " sae");
+-            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+-                g_string_append(key_mgmt_conf, " ft-sae");
+-        }
+     } else if (nm_streq(key_mgmt, "wpa-eap")) {
+         if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)) {
+             g_string_append(key_mgmt_conf, " wpa-eap-sha256");
diff --git a/debian/patches/Revert-supplicant-print-interface-capabilities.patch b/debian/patches/Revert-supplicant-print-interface-capabilities.patch
new file mode 100644
index 00000000..9bcb5535
--- /dev/null
+++ b/debian/patches/Revert-supplicant-print-interface-capabilities.patch
@@ -0,0 +1,104 @@
+From: Michael Biebl <biebl@debian.org>
+Date: Mon, 21 Mar 2022 15:39:18 +0100
+Subject: Revert "supplicant: print interface capabilities"
+
+This reverts commit 0109328085aec07b0d9fc560e6432e0be33a73b6.
+---
+ src/core/supplicant/nm-supplicant-interface.c |  9 --------
+ src/core/supplicant/nm-supplicant-manager.c   | 31 +++++++++++++++++++--------
+ src/core/supplicant/nm-supplicant-types.h     | 13 -----------
+ 3 files changed, 22 insertions(+), 31 deletions(-)
+
+diff --git a/src/core/supplicant/nm-supplicant-interface.c b/src/core/supplicant/nm-supplicant-interface.c
+index a38ebf1..82ede56 100644
+--- a/src/core/supplicant/nm-supplicant-interface.c
++++ b/src/core/supplicant/nm-supplicant-interface.c
+@@ -1260,15 +1260,6 @@ _starting_check_ready(NMSupplicantInterface *self)
+         return;
+     }
+ 
+-    _LOGD("interface supported features:"
+-          " AP%c"
+-          " FT%c"
+-          " SAE%c"
+-          "",
+-          NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_AP),
+-          NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_FT),
+-          NM_SUPPL_CAP_TO_CHAR(priv->iface_capabilities, NM_SUPPL_CAP_TYPE_SAE));
+-
+     set_state(self, priv->supp_state);
+ }
+ 
+diff --git a/src/core/supplicant/nm-supplicant-manager.c b/src/core/supplicant/nm-supplicant-manager.c
+index 7cf1a2b..4c326fa 100644
+--- a/src/core/supplicant/nm-supplicant-manager.c
++++ b/src/core/supplicant/nm-supplicant-manager.c
+@@ -168,6 +168,19 @@ _caps_set(NMSupplicantManagerPrivate *priv, NMSupplCapType type, NMTernary value
+     priv->capabilities = NM_SUPPL_CAP_MASK_SET(priv->capabilities, type, value);
+ }
+ 
++static char
++_caps_to_char(NMSupplicantManagerPrivate *priv, NMSupplCapType type)
++{
++    NMTernary val;
++
++    val = NM_SUPPL_CAP_MASK_GET(priv->capabilities, type);
++    if (val == NM_TERNARY_TRUE)
++        return '+';
++    if (val == NM_TERNARY_FALSE)
++        return '-';
++    return '?';
++}
++
+ /*****************************************************************************/
+ 
+ static void
+@@ -995,15 +1008,15 @@ _dbus_get_capabilities_cb(GVariant *res, GError *error, gpointer user_data)
+           " FAST%c"
+           " WFD%c"
+           "",
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_AP),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_PMF),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_FILS),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_P2P),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_FT),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_SHA384),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_MESH),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_FAST),
+-          NM_SUPPL_CAP_TO_CHAR(priv->capabilities, NM_SUPPL_CAP_TYPE_WFD));
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_AP),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_PMF),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_FILS),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_P2P),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_FT),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_SHA384),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_MESH),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_FAST),
++          _caps_to_char(priv, NM_SUPPL_CAP_TYPE_WFD));
+ 
+     nm_assert(g_hash_table_size(priv->supp_ifaces) == 0);
+     nm_assert(c_list_is_empty(&priv->supp_lst_head));
+diff --git a/src/core/supplicant/nm-supplicant-types.h b/src/core/supplicant/nm-supplicant-types.h
+index ae2db3f..8836bba 100644
+--- a/src/core/supplicant/nm-supplicant-types.h
++++ b/src/core/supplicant/nm-supplicant-types.h
+@@ -116,19 +116,6 @@ NM_SUPPL_CAP_MASK_GET(NMSupplCapMask features, NMSupplCapType type)
+     return (NMTernary)(f - 1);
+ }
+ 
+-static inline char
+-NM_SUPPL_CAP_TO_CHAR(NMSupplCapMask features, NMSupplCapType type)
+-{
+-    NMTernary val;
+-
+-    val = NM_SUPPL_CAP_MASK_GET(features, type);
+-    if (val == NM_TERNARY_TRUE)
+-        return '+';
+-    if (val == NM_TERNARY_FALSE)
+-        return '-';
+-    return '?';
+-}
+-
+ /*****************************************************************************/
+ 
+ /**
diff --git a/debian/patches/series b/debian/patches/series
index a2d7e06d..313613e5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,4 @@
 Force-online-state-with-unmanaged-devices.patch
+Revert-supplicant-enable-WPA3-for-WPA-PSK-connections.patch
+Revert-supplicant-print-interface-capabilities.patch
+Revert-supplicant-detect-the-SAE-interface-capability.patch